Add simple-bucket example: generic Bucket API -> S3 via kro + api-syncagent

[iakmc]

Adds a working example of the API extraction idea for object storage: a consumer orders a Bucket through the generic storage.opendefense.cloud/v1alpha1 API in a single kcp workspace, kro translates it into a vendor resource, and it gets fulfilled on a local S3 emulator (floci). Status and a credentials secret flow back to the consumer, who never touches a vendor API.

Everything runs on one kind cluster and one kcp workspace - no cloud account needed.

There's also a second path that swaps kro's translation for the actual provider-gcp controller (built from a sibling checkout) against a GCS emulator, which turned up two real schema mismatches between our own generic API and the real one: storageClass is lowercase in the real SDK but capitalized in ours, and status.bucketSecret is a plain string in the real SDK instead of the {name: ...} object shape we assumed. Both are fixed here.

Layout

• api/opendefense/v1alpha1 - the generic Bucket API
• api/s3/v1alpha1, cmd/, internal/ - a small operator that provisions on any S3-compatible backend
• providers/floci-aws, providers/provider-gcp, providers/gcp-crossplane, providers/aws-crossplane - one dir per provider, swappable via task rgd:gcp / task rgd:s3
• examples/simple-bucket - the runnable example
• hack/run.bash - every workflow, wrapped by Taskfile.yml/Makefile

Running it

task all                  # kind + kcp + kro + floci-aws + api-syncagent, order a bucket, print results
task translation           # re-print the result any time

task provider-gcp          # same thing but through the real provider-gcp controller against floci-gcp
task provider-gcp:translation

Manual checks after either:

task forward
KUBECONFIG=kubeconfigs/workspaces/storage.kubeconfig kubectl get buckets -o yaml
kubectl --kubeconfig kubeconfigs/kind.kubeconfig get s3buckets -A -o yaml     # or gcpbuckets for the provider-gcp path
KUBECONFIG=kubeconfigs/workspaces/storage.kubeconfig kubectl get secret <name>-credentials -o json | jq -r '.data | to_entries[] | "\(.key)=\(.value|@base64d)"'

task cleanup removes the example bucket, task destroy tears down the cluster.

The Crossplane-based GCP path (task crossplane, task rgd:gcp) is scaffolded but I haven't run it.

Ran task all and task provider-gcp from a torn-down cluster a few times while working on this, both come up clean. Both go modules build, YAML validates.